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We address the problem of estimating the phase cf> given N copies of the phase rotation u<f, within 
an array of quantum operations in finite dimensions. We first consider the special case where the 
array consists of an arbitrary input state followed by any arrangement of the N phase rotations, and 
ending with a POVM. We optimise the POVM for a given input state and fixed arrangement. Then 
we also optimise the input state for some specific cost functions. In all cases, the optimal POVM is 
equivalent to a quantum Fourier transform in an appropriate basis. Examples and applications are 
given. 
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I. INTRODUCTION 

Extracting information that is encoded in the relative 
phase of quantum systems is exploited in several quan- 
tum information processing tasks and applications. For 
example, most existing quantum algorithms with super- 
polynomial speed-up involve phase estimation Q and 
more recently it was shown that one natural formula- 
tion of the phase estimation problem is BQP-complete 
Q. Moreover, information is encoded into phase proper- 
ties in some quantum cryptographic protocols Q , and in 
schemes on which atomic clocks are based Q. Therefore, 
the issue of estimating the phase in the most efficient way 
is of fundamental importance. 

In this paper we address the problem of optimally esti- 
mating the phase in a quantum network of qubits given 
N copies of the phase rotation = exp(i|l)(l|</>), where 
|0) and |1) denote the computational basis of a single 
qubit. 

There is a variety of relevant scenarios that can be con- 
sidered. For example, the most general scenario, where 
one can prepare any initial state, and apply an arbitrary 
quantum circuit including the N phase rotation gates, is 
considered in [l[ for arbitrary cost functions, and in Q 
for a specific cost function. In [l| it is shown that for any 
cost function, the general case can be reduced to optimiz- 
ing the initial state of a procedure with a very specific 
form. More specific scenarios are relevant, for example, 
when performing state estimation (e.g. [ill ]) or phase es- 
timations in other special circumstances, such as in the 
final step of a dihedral hidden subgroup algorithm [l(|. 



The paper is organised as follows. In Sect. [TT] we in- 
troduce these specific phase estimation scenarios, where 
the phase shift gates are applied in a special way. In 
Sect. IIIII we optimise the phase estimation procedure in 
these cases, by first deriving the optimal POVM for a 
fixed initial state and cost function, and then by opti- 
mising the average cost also on the form of the initial 
state. In Sects. IIV1 IVl and I VII we give some examples 
of interest where our results can be applied, namely the 
case of phase estimation in a system of N identically pre- 
pared qubits, the Shor algorithm and the dihedral hidden 
subgroup problem. Finally, in Sect. I VIII we summarise 
the main results and discuss their implications. The pa- 
per ends with some appendices where some details of the 
derivations presented in the text are reported. 



II. SPECIAL CASE 

In this section, we will study a special case of the 
general problem of optimal phase estimation, where we 
restrict attention to one particular way of applying the 
phase rotation operator it^ some finite number of times, 
and we also restrict attention to a special (but widely 
used) class of "cost functions" . 

In particular, we consider the task of estimating the 
unknown phase shift parameter <fi e [0, 27r] of a unitary 
transformation XJ$ acting on L qubits (with Hilbert space 
H® L , T-i-C 2 ), with C/0 of the form 
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where is the elementary single qubit phase-shift gate 
defined in the introduction. More explicitly the Zth qubit 
undergoes the unitary phase shift 

|0>j -> |0),, (2) 
|l>i ~ e^l),, (3) 

where {|0)j, |l)z} is a basis for the Z-th qubit and ni is an 
integer number, with the constraint n\ = N. 

The operator Ufa 27r-periodic with respect to ft, op- 
erates locally on each of the L qubits, and in the 
Schrodinger picture it acts on a known initial state 
|*o) G H® L . The general scenario is illustrated in Fig.Q] 
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FIG. 1: Network representation of the action of the unitary 
operator acting on L qubits U$ = ^f = iU^ft , with n; integers. 
Each box represents a single qubit unitary phase shift opera- 
tion. 

The problem we want to address can be phrased as 
follows: 

Given the set of numbers {ni, I = 1, . . . , L}, with 
m = N , we want to find the best measurement 
procedure to estimate the phase ft. 

This estimation problem is posed in the general frame- 
work of quantum estimation theory Q. One first defines 
a cost function C{ft*,ft), which assesses "the cost one 
has to pay" for errors in the estimated value 4>* when 
the true one is ft (such a function is typically a non de- 
creasing function of \<f> — <j>*\ so that we pay more for 
larger errors in the estimate). For any given cost func- 
tion C(ft*, ft) and a priori probability distribution po(ft) 
for the true value ft one then evaluates the average cost 
in the estimate 

C= dftp (ft) dft*C(ft*,ft)p(ft*\ft) , (4) 
Jo Jo 



where p(ft*\ft) is the conditional probability of estimating 
ft* given the true value ft. The conditional probability is 
given by the Born rule 

p(ft*\ft) = Tr[D^U^ )(^o\Ul} , (5) 

where Dfa denotes the POVM density [7[ of the estima- 
tion, with Dfa a positive operator, normalized as 

/ = /, (6) 

Jo 

I denoting the identity operator on H.® L . The estima- 
tion problem consists in finding the optimal POVM which 
minimizes the average cost C in Eq. ^ . 

We assume that ft is a priori uniformly distributed in 
[0, 27r] with probability density po(ft) = ^ ( see O for an 
explanation). Moreover, we want to have no privileged 
phase value in the estimation, hence the error is paid only 
as a function of the distance between the true value and 
the estimated one, so that the cost function is actually an 
even function of a single variable C(ft*,ft) = C(ft* — (ft). 
In the following we will consider some examples of cost 
functions corresponding to relevant optimization criteria. 

For a cost function that depends only on ft* — ft, one 
can prove 0] that there exists an optimal POVM which 
is covariant, namely 

dft^Dfa = U^Ul^t , ( 7 ) 

where £ = 2ttDq is a positive operator, corresponding to a 
conditional probability p(ft*\ft) that will also depend only 
on ft* — ft. Therefore, using Eq. J5| and the invariance of 
the trace under cyclic permutations one has 

p(ft*\ft) = p{ft* ~ ft) (8) 

= Tr[l^,ig* )(* |] (9) 

= Tt[tf}_ ,A,^-*.|*o><*o|]. (10) 

In other words, the POVM is generated from a positive 
operator £ under the action of the unitary Abelian group 
of the operators Ufa, with ft* € [0, 2ir]. Hence the prob- 
lem is reduced to finding the positive operator £ that 
minimises the cost C in Eq. (|4"|). 

It is convenient to seek the solution of the optimization 
problem using the representation of the shift operator K 
defined as 

U+ = expftKft). (11) 

The operator K has integer (possibly degenerate) spec- 
trum that is contained in Z g for q = N + 1 (the 27T- 
periodicity of Uq in Eq. (Q]) implies integer values for the 
spectrum of K). In the following we will denote by Pk 
the projector over the eigenspace of K corresponding to 
the eigenvalue teZ,. We introduce a (generally incom- 
plete) set of orthonormal states {|fc)} uniquely defined as 
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follows. For k £ specif, define pk = (^ol-Pfcl^o) an d for 
those k such that pk ^ let 

lib) = «^ (12) 
\pPh 

(recall that the initial state of the L qubits |^o) is known 
by hypothesis). In the following we will denote by S C Z 9 
the set of eigenvalues k such that Pk\^o) ^ 0. 

The problem of state estimation is now restricted to the 
Hilbert space K = Span{|fc), k £ S}, with dim(/C) < q. 
Therefore, without loss of generality, the POVM density 
can be completed in the block diagonal form 

= l£ © Df (13) 

on U® N = /Ce/C- 1 , with any arbitrary POVM den- 
sity on K 1 - (the component of the POVM density 
acting on the subspace K can be arbitrary because the 
state | "Jo) has vanishing projection on this subspace and 
therefore this component does not give any contribution 
to the average cost). 

The above procedure has been designed to deal with 
the (possible) degeneracy of the operator K, reducing the 
problem to the "canonical" phase estimation problem for 
non degenerate shift operator H on the space K, 

|* ) -» exp(iH<f>)\H> ), H = Y,Mk)(k\ (14) 
with initial state 

|*o> = 5>*l*>" (15) 

fees 

Notice that due to arbitrariness of the POVM density 
complement D 1 ^ on K. 1 - , it is always possible to complete 
§ to Z q , without changing the optimality of the POVM. 

Note that this implies that the optimal POVM de- 
pends only on the set S, which is contained in the set 
of integers which can be expressed as J^- biUi, for some 
bi £ {0, 1} (also referred to as "subset sums" of the set 
{ni,n 2 , ■ • ■ ,til})- The choice of the initial state |\I>o) de- 
termines the weight Xk of each possible integer k of this 
form, and we define S to be the k with Xk ^ 0. 

This means that if we were given the freedom to choose 
the initial state l^o), then all the partitions of N into 
parts m, Ti2, ■ ■ ■ , til, with the same subset sums lead to 
the same optimal expected cost for estimating <f>. 

Given full freedom to partition N, one can always 
achieve all possible subset sums between and N. One 
obvious way to achieve this is to have L = N and ri\ = 
ri2 = ■ ■ ■ = riN = 1. However this requires N qubits. 
One call also achieve all subset sums with 0(log 2 N) 
qubits by letting m = 2*, for < i < L = [log 2 iVj, 
and riL = N — 2 L + 1. A simple basis change allows one 
to assume that \k) is a tensor product state represent- 
ing the integer k expressed in binary (described in lAl and 
illustrated in Fig. [5J) . 



III. OPTIMAL PHASE ESTIMATION IN THE 
SPECIAL CASE 

In this section we will review the derivation of the op- 
timal procedure to estimate the phase <fi m El- ([111) 0- 
We will first derive in subsec. IIII Al the optimal POVM 
for a fixed initial state l^o) and for a given cost function. 
As mentioned above, the optimal POVM is the one that 
minimises the average cost in Eq. ^ . We will show that a 
general solution can be found, that depends on the form 
of the initial state |^o) only through the orthonormal 
set {\k), k £ §} and that holds for a large class of cost 
functions which includes for example the fidelity and the 
window function as special cases. Later, in subsec. IIIIB1 
we will further optimise the solution by deriving the form 
of the initial state |^o) that leads to the minimum aver- 
age cost for a chosen cost function and using the optimal 
POVM. In this way we give a prescription to prepare the 
initial state of the L qubits in order to have the most 
efficient phase estimation for a given network (i.e. for a 
given set of integer numbers {ni, 1 = 1,..., L}) and for a 
given cost function. 

A. Optimal POVM 

In order to find the optimal phase estimation procedure 
we have to derive the positive operator \ — 2ttD^ on the 
subspace K,, that minimizes the cost C in Eq. We 
will conveniently use the representation of x m t ne \k) 
basis, namely 

X=£lM%Wk- (16) 

h,keS 

As a cost function we consider a generic 27r-periodic even 
function, which can be expressed as a Fourier series in the 
form 

oo 

C{4>) = -J2 Cl cos ^- 

1=0 

The average cost can then be written as 

C = -co-f> f ^cos/0 (18) 

x £ e« h - k » X hk(k\*o){*o\h) ■ (19) 
hkes 

By calculating the integrals the above expression can be 
reduced to 

1 9-1 

C = -co~-Y, c i E (*o|h)x/.fc<*|*o) • (20) 

1=1 h,k<£S, \h-k\=l 

Notice that the sum over / is truncated by the vanishing 
of the |^o) components. Positivity of the operator % 
implies that [8J] 

\Xhk\ < y/XhhXkk = 1 , (21) 
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where the last equality Xhh = 1 V7i is a consequence of the 
POVM completeness condition J d(pD^ = Ijc {Ik. is the 
identity operator on the Hilbert space JC). By exploiting 
Eq. (|2ip we can now write the following inequality 



sign(cz) Y (^o\h)xhk(k\^ ) 

h,k<£S, \h-k\=l 

< Y K*o|fc>||<fc|*o>| 

h,k£§, \h—k\=l 



(22) 



The equality in the above equation is achieved only for 
Xhk = sign(c|/ l _ fe |) (we recall that (*o|&) > Vfc G § by 
construction). The average cost is minimised when the 
equality in Eq. (|22p is satisfied and the minimum value 
is given by 
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d\ Y K*o|fc>||<fc|*o>| (23) 
h,fces, |ft-fc|=i 



where we can set sign(O) = 1, since the cost C is inde- 
pendent of Xhk for c | | = 0. Notice, however, that pos- 

itivity of the operator x m t ne form Xhk — s ig n ( c |?i-fc|) is 
not guaranteed for an arbitrary choice of the coefficients 
q . For the rest of Section IIHI we will restrict to the par- 
ticular form of coefficients c; > V7 > 1 considered by 
Holevo @. In this case x has all unit elements Xhk = 1 
and is positive. The optimal POVM corresponding to 
Eq. |0 can be written as follows 



by Eq. (|24[). We want to point out that the same POVM 
(f2"4"| would optimize the average cost for Holevo type cost 
functions even for a certain class of mixed states Q. 

The optimal POVM in the form (|24|) does not corre- 
spond to a straightforward physical measurement scheme 
(that is, one with finite resources, including finite resolu- 
tion) because it gives a continuous value of the phase as 
the estimated value. We will now find a more convenient 
discrete description. 

We can first complete the set § to 1 q by appropriate 
choice of the arbitrary density , extending JC to the 
span of those vectors \k) corresponding to Pfc| v I')o = 0, 
and restricting K. accordingly, without changing the op- 
timally of the POVM. The optimal relevant POVM den- 
sity is then given by Eq. (|2"4")) , with 
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Ye** 

k=0 



\k). 



(26) 



Due to the covariance of the optimal POVM and the 
uniform prior distribution po(<j>), the average cost C in 
Eq. (TT9"]) takes exactly the same value if the continuous 
POVM (|24|) is restricted to only a set of q equally spaced 
values <p s = 2ls, s = 0, 1, . . . , q — 1. This can be easily 
proved using the identity 



2tt 



s n0 = I -. 
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e in<f> _ _ e in^ s 
y s=0 



(27) 



where 



>D1 



\e»)K 



2tt 



i(j>\ 



Ye iH \k). 



(24) 



(25) 



We want to stress that the Holevo condition on the 
Fourier coefficients is not very restrictive. In fact, 
it corresponds to a large class of optimization cri- 
teria. It includes for example the likelihood crite- 
rion for Cl{4>) = — ^2tv(<P), the periodicized variance 
for Cv{4>) — 4sin 2 (</>/2) and the fidelity optimization 
F(<f>) = |(* o |[/ |*o)| 2 with C F (cj>) = 1 - F(4>) and 

c i = 2 Y,h,k£$,\h-k\=l x h x k where x k = (fc|*o). No- 
tice that also a cost function often considered implic- 
itly in computer science, namely the "window function" 
C w {4>) = for |0| < e, C w ((f>) = 1 for |0| > e, defined for 
4> G [— 7r, +7r], can be included in this class under some 
restrictions. Actually, the Fourier coefficients for such a 
function take the form Co = — — 1 and ci = sin(le)/lir for 
I > 0, and therefore they are all positive for < / < q 
when the width of the window function satisfies the con- 
dition e < ir/q. Since the Fourier coefficients that con- 
tribute to the average cost in Eq. ([20)l correspond to 
I < q and are all positive (apart from eg but this does 
not affect the optimisation of the POVM), the optimal 
POVM for the window function with e < n/q is still given 



with n 6 Zq. Therefore, for every covariant POVM there 
exists always a discrete POVM giving the same aver- 
age cost. In the present case of Holevo cost the optimal 
POVM becomes the orthogonal projector- valued measure 



E s = \<j> s )(<p s 



where 
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ik<p s 



\k) 



(28) 



(29) 



are orthogonal states for s — 0, . . . , q — 1. Notice that 
from the form of states (|29|) one can see that this esti- 
mation procedure can be implemented by the customary 
discrete quantum Fourier transform (QFT) network. Ex- 
act implementation of the QFT for any positive integer 
q was detailed in 



B. Optimal states 

We will now perform a further optimisation, namely 
we derive the form of the initial state |^o) that leads to 
the minimum average cost (how to generate such initial 
states is described in [l2j ). As we will see soon, this step 
depends crucially on the form of the cost function, which 
has to be specified in advance. We first notice that for 
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a covariant POVM the average cost can be recast in the 
following form 



C = Tr[C|* )(*o|] 
where the cost operator is defined as 



C 



(30) 



(31) 



Without loss of generality we will take § = Z q in the 
following. (Notice that one can define the operator C 
with the complete POVM density D$ over H. = JC (&JC- 1 , 
since the term will not contribute to the trace (|30ll ). 

The average cost C can be minimized over the coeffi- 
cients of j^o) by using the Lagrange multipliers method 
to account for the normalization constraint. One has to 
minimize the bilinear function 

£[*o] = (*o|C , |* )-A(*o|*o) (32) 
which gives the eigenvalue equation 

£|*o) - A|* ) (33) 

where now the Lagrange parameter A plays the role of an 
eigenvalue. As mentioned above, we have now to specify 
the form of the cost function. We will consider two partic- 
ular cases which correspond to the optimal POVM (f2"4")l . 
We first consider the cost function Cv{4>) = 4sin 2 (^/2) 
(more details are given in[B]). In this case the cost op- 
erator in Eq. (|3"Tj) takes the form 



where 



Cv = e+ + e_ 
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e + = £) I* + 1><*I. e_=4. 



(34) 



(35) 



In terms of the coefficients Xk — (^ol^) > the eigen- 
value equation becomes the recurrence relation 

x k+ i(X) + Xfc-i(A) - (2 + A)z fe (A) = (36) 

with boundary conditions x_i(A) = x q (X) = 0. The 
solution can be written in terms of the Chebyshev poly- 
nomials of the second kind [l(| , leading to 



2 . 3 + 1 

■ Sin -7T 



q + 1 \q + l 
The minimum cost in this case is given by 

Cv = sii 



2(9+1) 



(37) 



(38) 



As a second example we consider the window function 
cost Cw(4>) defined in the previous subsection with the 
condition e < tr/q, so that the optimal POVM is still 



given by Eq. ([24]) . In this case the cost operator takes 
the form 



w 



/ e\ 1 v-^ sink , , 

( 1 -^)-2.E- r ( e + + e -) 



where 



q-l-l 
fe=0 



1=1 



l)(k\, 



( e +) f - 



(39) 



(40) 



The eigenvalue equation has the form 



Xk ( A H 

7T 
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- y 

2tt ^ 



sin(fc — m)e 



0. (41) 



m(^fc)=0 



This has an easy solution for very narrow window func- 
tions, such that e <C 1/q. In this case the coefficients 
sin(me)/m can be approximated by a constant indepen- 
dent of m and the solution for the optimal state |^o) is 
simply given by the equally weighted state, i.e. 

x k = 1/y/q, k = 0,...,q-l. (42) 

The minimum cost in this case takes the form 



Cw 



i 



(43) 



IV. EXAMPLE 1: PHASE ESTIMATION OF TV 
IDENTICALLY PREPARED QUBITS 

We specify here the phase estimation problem to a par- 
ticular case: estimation of the phase shift undergone by 
N qubits initially in the same state, namely 

U4a\0) + b\l)f N = (a|0) + be^\l)f N , (44) 

i.e. the unitary operator U$ is given by 



U<j, = ®£Li exp 



(45) 



where of represents the Pauli operator for the i-th qubit. 
In the network language of Fig. [1] this case corresponds 
to 7i; = 1 V/. One can see that for both a ^ and 6^0 
the \k) basis introduced in subsec. UlI Al is given by 



|fc) = e i<t>k \k) 



sym 



(46) 



N 



-1/2 



y *($>-*)®£ii* 

{ Si =0,l} » 



(47) 

namely it is the basis of the symmetric multiplet with the 
choice of phases (f>k = (N — fc)arg(a) + fcarg(6) (in this 
case q = N + 1 because the subspace JC is the symmetric 
subspacc of the N qubits). The optimal POVM restricted 
to the symmetrical tensor subspace JC = \H 
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is given in Eq. ([28|) for cost functions of the Holevo 
class. 

The optimized state among the ones of the form (|44|) 
for the cost function Cv{4>) — 4sin 2 </>/2, and also for 
the fidelity error 1 - F((f>) with F((f>) = \a\ 4 + \b\ 4 + 
2|a| 2 |&| 2 cos(0), is given by a = b and leads to the mini- 
mum cost 



(48) 




fe=0 



This result has also been reported in Ref. [111 ]. 

Notice that we can also phrase the problem in a wider 
sense and ask for the optimal strategy to estimate the 
phase shift generated by the unitary operator (|4"5|) on a 
generic symmetric state of the N qubits and optimise the 
average cost with respect to the initial state, as in subsec- 
tion QTTB] It is interesting to notice that in this case the 
optimal states for the cost function Cy and the window 
cost function, given in Eqs. (f37|) and ([42)) respectively, 
are entangled states of the N qubits. 

Notice also that for U^oi the form (|45[) we can solve an 
even more general problem, where the initial state |^o) 
does not belong to the symmetric subspace. In this case, 
in fact, the best POVM is of the form Z^E S Z, where 
|*o> = Z\ko) and |A ) e (H® N ) , the symmetric sub- 
space of the N qubits (one can always find a suitable Z 
commuting with a U<p of the form in Eq. (|35|)). 



V. EXAMPLE 2: THE SHOR ALGORITHM 

In this section we will consider another particular case, 
corresponding to the phase estimation as the final step of 
the Shor algorithm in the formulation given in Ref. Q. 
This step was also optimized in [1 91 ] . The phase operator 
Uff, in this case has the form 



L 2< 
l=l a d> 



(49) 



This corresponds to the network representation of Fig. [T] 
with ni — 2 l ~ 1 . In this case the problem does not have 
degeneracy and the subspace K. is the whole Hilbert space 
7i® L of the L qubits, namely q = 2 L . The eigenvectors 
of the operator K are simply given by the computational 
basis of the L qubits 



entangled. To be useful in practice, we would also need 
to consider the computational complexity of creating this 
state for use as a possible initial state for the Shor algo- 
rithm. 

If the window cost function is considered, in the limit 
of very small width analysed in the previous section, the 
optimal state is given by 



l*o> 



(|0) + |1» 



(51) 



namely it is a factorised state of the L qubits, as the one 
considered in the scheme of Ref. [H . 



VI. EXAMPLE 3: DIHEDRAL HIDDEN 
SUBGROUP PROBLEM 

The hidden subgroup problem (HSP) is the problem of 
finding generators for a subgroup if of a group G given 
a black-box that implements a function / : G — » X sat- 
isfying f(x) — f(y) x — y G K . In other words, / is 
constant on cosets of K and distinct on different cosets. 

Assuming a reasonable presentation of the group G, 
there is an efficient quantum algorithm for solving the 
HSP in Abelian groups. This algorithm is a natural gen- 



eralization of Shor's algorithm [14j and can be cast as a 
phase estimation problem as outlined in [3[ (based on the 
approach of |15|). There has been limited success in solv- 
ing the HSP for non-Abelian groups. See 12011 fo r recent 
results and references. Ettinger and H0yer [161 ] reduced 
the HSP for the dihedral group to the following phase 
estimation problem: 

Given a polynomial (in n) number of qubits of the form 
|0)+e lfc ^|l) and the inte gers kj , where the kj are selected 
uniformly at random from {0, 1, 2, . . . , 2™ — 1}, estimate 
</> with error at most i. 

Ettinger and H0yer showed that an optimal measure- 
ment would solve the HSP with high probability. 

Our results from Section [IT] tell us the optimal 
POVM. Let S = E"=i%- 
of solutions (bi,b 2 , ■ ■ ■ , b n ) £ 

of such solutions. 
Note that 



.IE. 



let rij 
For j 



Let Sj equal the set 
{0, 1}" to the equation 



= \Sj\ 
with rij 

...bn). 



equal 
f 0, 



the 
let 



number 

ISA = 



i=i\si) 



k = j2^'- 1 

1=1 



(50) 



For cost functions of the Holevo class the optimal POVM 
in Eq. I|28p here corresponds to the Quantum Fourier 
Transform measurement discussed in Ref. [3|, where a 
network realisation is also given. Here, our general 
method proves that this measurement procedure is op- 
timal. 

Regarding the optimized states in Eq. ([57| for the cost 
function Cy one should notice that the state is partially 



(|0>+e^|l»®. • .®(|0}+e^|l» = £ ^f\S 3 ). (52) 

3=0 

Thus the optimal POVM could be achieved by first 
performing a unitary basis change U that maps \Sk) <—> 
\k), where the integer k is represented as a binary 
string in the computational basis, followed by a quan- 
tum Fourier transform in the computational basis, and a 
measurement in the computational basis. 

However, implementing U would solve the subset sum 
problem, which is known to be NP-complete (since U~ x 
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maps \k) to a uniform superposition of strings represent- 
ing subsets with sum k). However, such a measurement 
is optimal, and a sufficiently good approximation of this 
measurement would suffice. Regev [17| showed that it 
suffices to be able to solve the subset sum problem on 
average in order to find a sufficiently precise estimate of 
(j> that allows one to solve the Hidden Subgroup Problem 
for the Dihedral group. 



VII. DISCUSSION 

In this paper we have addressed the problem of finding 
the optimal estimating procedure for the real parameter 
</> given N copies of the single qubit phase rotation u$ 
within a quantum network in finite dimensions. We have 
derived the optimal measurement procedure in the spe- 
cial case where the network consists of an arbitrary input 
state followed by any arrangement of the N phase rota- 
tions, and found also the optimal states corresponding to 
some cost functions of interest. 

This result is general and can be applied to many cases 
of interest. In particular, we have considered the phase 
estimation problem as the final step of the Shor algorithm 
in the formulation given in Ref. [3( and we have proved 
that the quantum Fourier transform performed in that 
case is indeed the optimal phase estimation procedure. 
As another example, we have also shown how our result 
can be applied to the dihedral hidden subgroup problem. 



APPENDIX A: PHASE SHIFT CIRCUIT 

The network illustrated in Fig. [5] will achieve the phase 
shift operator \k) i— > e l ^ k \k) where k is represented in 
binary as the string of bits k$k\ . . . fe n _ifc„, where k = 
k + 2kx + ■ ■ ■ + 2"- 1 fc„_ 1 + 2 n k n . 



APPENDIX B: OPTIMIZATION OF FIDELITY 
ERROR 

In this appendix we derive the minimum obtainable 
value of the fidelity error, given by 



C F 



1 



M-l „ 27 r 



2tt E j ,, 



Pr(y|0) -CH0,^)# (Bl) 



iV-l 



(B2) 



j=0 



We start by decomposing the complex coefficients ctj into 
the two real parameters p, q according to ay = pj +qj \J — 1 
for every < j < N. This means that we have to mini- 
mize the expression 



1 - 2C F 



N-l 

E p j p 3- 

3=0 



N-l 

E fc'fc+i 

3=0 



(B3) 



under the normalisation condition for the reals pj and qj 
that 



A* 



N 



E^ 2 + E< 



= i 



(B4) 



First we will optimize the p coefficients for the general 
case < Y2Pj = P — 1- We do this by the introduc- 
tion of a Lagrange multiplier A and two additional values 
P-i = Pn+i — 0. The method of Langrange multipliers 
requires that the partial derivatives d/dpt of the function 
J2PjPj+i + ^^2p"j nave to be zero. This leads to the set 
of equations for all < t < N: 



_d_ 

dp t 



N+l 

E 



N+l 



PjPj+1 



A f? = > (B5) 



v i=-i j'=-i 
and hence the recurrence relation: 

Pt+i = -2Api -pt-i 



(B6) 



This relation can be solved with the help of the Cheby- 
shev polynomials of the second kind (see [l(| Chap. 8.94, 
p. 1032), using the identification Ut(— A) = pt- When 
taking into account the restrictions p-\ = Pn+i = and 
^p'j = Mi the possible solutions are of the form 



2/i . f (t + l)kn 



(B7) 



for fee {1, 2, . . . , JV + 1}. For each of the possible values 
of k, the summation that we want to maximize equals 
(using pB] Chap. 1.361, p. 32): 



JV-l 

E 



PtPt+i = M cos 



kit 
N + 2 



(B8) 



The absolute maximum hence occurs when k = 1 and 
equals [j,cos(ir/N + 2). By the normalization condition 
of Equation (|B4[) we have for the q values that Yl Qj = 
1 — /i. Hence, the absolute maximum of the ^qjqj+i 
summation equals (1— /x) cos(7r/7V+2). The overall result 
is therefore the following. 

The maximum 1 — 2C p as in Equation (|B3[) is obtained 
for the a values 



o , = e 



iV. /_2 

AT4 



^sin(^) (B9) 



for any (non relevant) general phase factor e 1 ^'. The in- 
vestigated minimum then equals: 



C F — sin 2 ( 2W+i j 

t2\ 



(BIO) 



which gives C F = 0{\/N 2 ) as TV goes to infinity. 
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APPENDIX C: WHY A UNIFORM PRIOR? 

In this paper, we assign a uniform a priori probability 
for the value of <f>. This is important for the results in 
this section. There are very natural situations in which 
one should assume a uniform prior distribution, such as 
the case when there is no prior knowledge of the value 
of <f>. Another scenario (which is typical in computer 
science) where one is naturally led to consider the uni- 
form prior is in an adversarial scenario, where one party, 
Alice, is doing the phase estimation, and the adversary, 
Bob, picks the phase. Alice first describes the estimation 
procedure, and then Bob picks the phase <j> according to 
any probability distribution he wishes, with the intention 
of maximizing the expected cost for Alice. 

Alice must optimize her procedure to work well for 
any probability distribution for <p, since Bob will natu- 
rally pick the worst case distribution for <j>. Alice can 
foil Bob's intentions by "uniformizing" the distribution 
of the 4>. That is, she can guarantee that regardless of 
the distribution for <f>, her procedure will work as well as 
it does for the uniform distribution for <f>. That is, she 
can guarantee that the expected cost for any distribu- 
tion will equal the expected cost for the uniform prior 
distribution. 

Alice first takes any procedure A that is optimal given 
a uniform prior distribution for (f>. She then augments 
this procedure in the following way. She pick a random 
phase <f> r with uniform probability over [0, 2n). She then 
runs the optimal procedure for estimating <ft but replaces 
each instance of with u<p +< p r . This is easily done by 
adding a u<f, r gate after every instance of a u<f, gate. The 
procedure A will output an estimate u</,+0 r for u r j >+l p r . 

Alice outputs = u^4> r — 4>r as her estimate of <f>. 

This uniformization guarantees that regardless of the 
distribution for <j> that Bob chooses, Alice's new proce- 
dure performs with the same expected cost as the optimal 
procedure would with a uniform prior distribution. 

However, if Alice is restricted to using finite means, 
she may not be able to actually sample a uniform prior 
on the continuous set [0,27r). However, she can sample 
an arbitrarily fine discrete subset of these points, which 
should be enough for dealing with non-pathological cost 



functions C. Note that regardless of how fine a mesh 
of points Alice samples from to ultimately produce esti- 
mates (j>* , the values of <j>* will come from a finite set. 
Thus it is possible for an adversary to restrict to choices 
of <fi so that although the sets of numbers {0 — 0*} arc 
arbitrarily close for different <p, they are still disjoint for 
different cf). This allows for the construction of pathologi- 
cal cost functions for which even the slightest round-off in 
the outputs (jf can drastically change the expected cost. 
Thus we need to add further practical assumptions for 
C in the case that we don't wish to assume an a priori 
uniform distribution for (f>, but wish to justify a uniform 
prior distribution using an adversarial scenario. Essen- 
tially, it suffices that most of the time the function does 
not change very fast. More precisely, it suffices for exam- 
ple that |C(0)| < B < oo, and that for any 5 > there 
exists an integer Ng such that cost function doesn't vary 
by more than S over intervals of width less than 1/Ng, 
except for a set of points of measure at most 5/B. For 
example, any uniformly continuous cost function satisfies 
this. Any bounded function that increases monotonically 
as <f> tends away from also satisfies this. 

Knowing the details of the specific procedure she 
wishes to uniformize, and knowing the cost function 
C, which we assume is reasonably well-behaved as dis- 
cussed above, and given any e > 0, she can pick a 
large integer D e so that uniformly sampling the phases 
{2wx/D e \x = 0, 1, . . . , D e — 1} will yield a procedure with 
expected cost within e of the optimal expected cost in the 
case of a perfectly uniform prior distribution. 

The above discussion is only meant to justify that a 
uniform prior distribution is a meaningful assumption to 
make. In this paper, we will simply assume that the prior 
distribution for the <p is perfectly uniform in the interval 
[0,2tt). 
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